Privacy policy

ASTRA ECHO LTD operates Epub Translator and is the controller of personal data used to run the service. This policy covers visitors, anonymous previews, registered users and support enquiries. Contact us at the email below or at our registered office for privacy questions. Third-party services may also process information for their own purposes under their privacy notices.

You provide account details such as email and name, uploaded EPUBs and their metadata, language choices, translation requests and support messages. We create translations, progress records, usage and Credit entries. Google sign-in supplies basic profile information, such as name, email and profile image; we do not request Gmail or Google Drive access.

We process session identifiers, IP addresses or derived network identifiers, browser information and security/error records. Stripe supplies payment, order and subscription identifiers, amounts and status. Card details are entered with Stripe; our application does not store full card numbers or security codes.

Contract: we use account, book, task and payment information to provide requested previews and translations, manage purchases and deliver results. Without required information, we cannot provide those functions.

Legitimate interests: we use limited technical, usage and support records to secure the service, prevent abuse, investigate failures and improve reliability, balanced against your rights. Legal obligations: we keep necessary accounting records and respond to valid legal demands. Consent: where a separate optional use requires consent, we request it separately and you may withdraw it without affecting earlier lawful processing.

Translation sends selected text and bounded context, such as terminology and summaries, to the model provider or compatible gateway used for the task. This also applies to anonymous previews. Provider changes during recovery may send unfinished portions to another provider.

We do not use uploaded books to train our own general-purpose AI models. Provider retention and any training use depend on the provider and its contractual settings; we do not promise universal zero retention or no training across providers. Contact us before uploading if you need provider-specific information or assurances. Avoid uploading sensitive personal or confidential information you are not authorised to disclose.

Railway provides hosting, databases and storage. Cloudflare handles web traffic and security; Turnstile processes browser and network signals to detect automated abuse, not book content. Resend delivers verification and service emails, including necessary account or task details. Stripe handles checkout, billing and refunds. Google handles sign-in when selected. AI providers receive the text described above.

Access may be needed by authorised personnel for support and operations. We may disclose necessary records to professional advisers or authorities when legally required, or in a business transfer subject to applicable safeguards. We do not sell personal information or share it for cross-context behavioural advertising.

Authentication cookies maintain sign-in sessions, normally for 7 days with renewal during use. A guest cookie lasts up to 7 days to link an anonymous preview; it does not extend the book’s retention. The language cookie lasts up to one year. Local and session storage remember language, billing preferences and pending actions.

These features support login, security and your choices; we do not run advertising trackers in the application. You can clear or block storage in your browser, but login or preview recovery may stop working. Cloudflare, Google and Stripe may use their own security or functional technologies when you interact with them.

When enabled, Google Analytics 4 uses cookies and technical data to measure visits, traffic sources and page interactions. We disable Google Signals and advertising personalization signals. We do not send account names, email addresses or book content as custom analytics data.

Google Analytics loads only after you accept analytics cookies. You can reject them without affecting the service and withdraw consent at any time through Cookie settings in the footer. Withdrawing stops further analytics collection and removes our analytics cookies. We store your choice in this browser for 180 days, then ask again. This does not delete data already collected.

Book content follows the task lifecycle below. Expiry removes access and starts deletion of source files, results, translation text and checkpoints; cleanup retries can take additional time. Our service backups exclude book files and translation text.

Account details are kept while needed to maintain your account. Task metadata (including book titles, languages and usage), payment, security and support records may remain after content or account deletion where needed for accounting, disputes, fraud prevention or legal duties. Duration depends on those purposes and applicable limitation periods; backup copies age out under the backup rotation. Ask us about the records and retention applicable to your account.

• Unused uploads and free samples: normally 24 hours.
• Completed, unpaid full translations: 7 days after completion. Unresolved payments can delay cleanup until reconciled.
• Completed, paid translations: 24 hours after payment verification and unlocking, or after completion for Credit tasks. Downloading again does not extend the window.
• Failed tasks: retained until you or an administrator manually delete them. Active or paused tasks keep content needed for continuation.
• Shared source files: kept until all related tasks no longer need them. Deleted files cannot be restored from the metadata-only backups.

We use safeguards including HTTPS, access restrictions, private file storage and password hashing. Operational access is limited to what is needed for the service. No online system is completely secure; protect your account and contact us if you suspect misuse. Where a personal-data breach requires notice to you or a regulator, we will provide it as required by law.

Our suppliers may process information outside the UK or your country, where privacy laws may differ. The countries and safeguards depend on the provider used. UK restricted transfers require a lawful mechanism, such as applicable adequacy regulations or appropriate contractual safeguards (for example, the UK IDTA or UK Addendum), and any required assessment. Contact us for the destination and safeguards applicable to your data and how to obtain a copy; using the service is not a blanket consent to international transfers.

Depending on applicable law, you can request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests and withdraw consent for consent-based uses. Email support, preferably from your account address. We may ask for proportionate identity verification, and normally respond within one month; we will explain any lawful extension or refusal. Account deletion is handled through support, not a self-service button.

We do not use your data for solely automated decisions with legal or similarly significant effects. If an automated security or usage restriction appears wrong, contact us for review. You may complain to the UK Information Commissioner’s Office or your local data-protection authority without first contacting us.

The service is intended for adults, not children under 18. We do not knowingly seek personal information from children. If you believe a child has provided information, contact us so we can investigate and take appropriate steps to remove it. Do not upload a child’s personal information without appropriate authority and safeguards.

We publish updates and the revision date on this page. For material changes, we will provide a prominent service notice or email where appropriate before the change takes effect. We will explain any new purpose before using personal data for it and obtain consent where required. A policy update does not itself authorise a use that requires your consent.